Android Sideloading

By

Alexander Maule

Starting in 2027, Google will restrict how users can use their devices in an unprecedented decision that centralizes digital power in the hands of a few.

Google is about to cement changes that give them total control over all Android phones by effectively deprecating sideloading. Sideloading allows users to install apps on their Android smartphones the same way you would on a computer: by simply downloading a program off the web, transferring it to your device over USB connection or via a storage medium like a flash drive, and installing and running. But Google is tightening the reins: According to officially released documentation, In order to be installed, all apps — not just those on the Google Play Store, but apps from any source — will have to be signed with a cryptographically secured certificate. Each certificate corresponds to a Google developer account registered centrally with Google. If a user tries installing an unsigned app, it simply won’t install. This proof of ownership mechanism, which has already launched in Brazil and other regions, effectively gives Google total control over which apps are approved for usage.

The reason Google has provided for these changes is to stop malware and bad actors. As a carve-out, Google has offered users an option to enable sideloading apps from unverified apps in Android Settings, with a 24-hour “protective waiting period” delay. However, the enabling process runs entirely through Google Play services, not through the Android OS itself. Even with OS updates blocked, as long as you have Google Play services running in the background and are connected to the internet, this pathway could be arbitrarily restricted at any time without permission. Google Play services’ API encompasses everything from location information to emergency services and Google password manager, as well as many other services most apps require to function, so removing Play services is not feasible for average users.

Google is restricting activities in other ways, too. Android 17 now prohibits users from removing apps using command-line tools. Certain apps such as Google Chrome, or annoying bloatware that manufacturers and network carriers stuff in, cannot be removed normally. Such apps are unnecessary to the device operating and only serve to drain battery and eat up system resources. Now, the only way to remove unwanted apps now is rooting your device, a process which requires lowering protections against malware and viruses, voiding the device warranty, and potentially “bricking” the device if done incorrectly, making it unusable. This is likely to prevent users from removing the “Android Developer Verifier” app, a hidden system service that validates whether an app is verified to a developer, which is now pre-installed after Android 16 (but is currently disabled).

Registering as a Google developer requires paying a $25 fee, which, while fairly trivial, requires handing Google your credit card info. This process also requires a government-issued ID. These two factors means that any developer or digital activist living under an oppressive regime who wants to make and distribute communication tools will be exposing themselves to unnecessary risk.

We’ve already seen numerous attempts of governments using any means necessary to limit pathways for digital activists and journalists. In October, Russian regulator Roskomnadzor sent formal requests to Apple and Google demanding the removal of IStore, an independent news platform. IStore provides a lifeline to international news critical of the occupation of Ukraine, which is banned in Russia and requires a virtual private network (VPN) to access. Gershad, a crowdsourcing app used by women across Iran  to circumvent the “morality police” by providing real-time location updates of patrols, has been under continuous attacks by the Iranian government since its release in 2016, with Gershad and its APIs being banned. Despite continuous takedown attempts by the Iranian government, the app has continued to receive traffic, particularly after the September 2022 protests sparked by the murder of Mahsa (Jina) Amini at the hands of the morality police.

Governments in historically democratic countries have also increasingly targeted apps to stifle descent. In October 2025, the Department of Justice (DoJ), under the direction of then attorney general Pam Bondi, demanded that Apple remove several apps documenting ICE activity, including IceBLOCK, ‘Red Dot, and Eyes Up. Shortly thereafter, Bondi and then-Secretary of Homeland Security Krisi Noem posted on social media they had asked Apple to “take down ICEBLock apps” and Facebook to “remove a large page being used to dox and threaten our ICE agents in Chicago.” A federal judge later ruled in an 8-page memorandum that the government violated the first amendment rights of Eyes Up by using coercion and “thinly veiled threats” of prosecution, issued through public statements to compel Facebook and other platforms to self-censor and remove unwanted content. However, these incidents illustrate the clear risk of creating a centralized gatekeeping authority of what apps can be installed over apps. Beyond strengthening Google’s monopoly power over 72% of phones worldwide (according to FOSS post), it creates an opportunity for the government to — by proxy — control what you do with your device, including tools used to disseminate “undesirable” information.

Maintaining control over your technology should be a universal freedom, and tech companies are relying on the fact that most people in their day-to-day lives have little reason to pay attention or to fight back. As surveillance tightens in every public and private sphere, and as our autonomy to modify and distribute software freely becomes increasingly restricted, our collective sense of what is possible to do with our technology accordingly narrows to what is only allowed to exist by corporations like Google and Apple. This is not how it has to be. People are fighting back, and if we want to create a future in which our digital freedoms are not entirely at the whims of these tech higher powers (which for this generation of students is a substantial portion of our lives), we should all have a stake in this fight. Campus-wide conversations have been had about digital autonomy and ethics in the age of AI and the tech oligarchy, and the sentiment seems to often come around to a collective desire to have control, to engage, to dictate for ourselves what we want out of our technology — how to use it rather than letting it use us. Understanding what the people in control are doing and taking a stand is the first step.

The Keep Android Open initiative (whose mission, press statements, and resources can be found at keepandroidopen.org) has given actionable steps for Android developers and anyone who wants to participate. The things that most of us can do:

1. Install “F-Droid” (an alternative app store for free open-source apps) on your Android device, or monetarily support those developers. Despite the more limited selection compared to the Google Play Store, you can generally be assured that your data is not being collected, that you will not be subject to predatory monetization or advertisement features, and that you are supporting a healthier digital ecosystem. These platforms and applications get better the more people use them.

2. Contact tech regulators. Keepandroidopen.org has details for who to contact state-by-state. Ground-level work is extremely useful, but top-down regulation is the most scalable approach.

3. Spread the word. If you develop apps, don’t sign up for Google’s developer program, and encourage others to not comply. Many software organizations have signed an open letter to Google to stop this initiative (once again found on keepandroidopen.org), which should be read and shared as much as is possible.

4. For those who want more direct control over their Android devices, there are also privacy-oriented phone operating systems available, such as GrapheneOS or LineageOS. These are difficult to install if you aren’t as familiar with command-line navigation and file management (because Google has made it a hassle to implement, to discourage alternative software use), but there are resources that lay the process out well. The Beloit College MakerLab would like to offer assistance in-person with this and can provide those digital resources, so if this is of interest, anyone is welcome to email makerlab@beloit.edu for more information.

In a world increasingly dependent on digital ecosystems, the privilege of democratized information gathering and sharing should not be taken for granted. We are all affected by Google pulling the rug out from under Android consumers and developers, and if we desire agency, democracy, and transparency in our lives, this initiative and its consequences should be taken seriously.

Featured image: Good e-Reader

Author


Comments

Leave a Reply